Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L49/00—Packet switching elements
  • H04L49/55—Prevention, detection or correction of errors
  • H04L49/555—Error detection
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F11/00—Error detection; Error correction; Monitoring
  • G06F11/004—Error avoidance
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F11/00—Error detection; Error correction; Monitoring
  • G06F11/22—Detection or location of defective computer hardware by testing during standby operation or during idle time, e.g. start-up testing
  • G06F11/26—Functional testing
  • G06F11/273—Tester hardware, i.e. output processing circuits
  • G06F11/2736—Tester hardware, i.e. output processing circuits using a dedicated service processor for test
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F15/00—Digital computers in general; Data processing equipment in general
  • G06F15/76—Architectures of general purpose stored program computers
  • G06F15/78—Architectures of general purpose stored program computers comprising a single central processing unit
  • G06F15/7807—System on chip, i.e. computer system on a single chip; System in package, i.e. computer system on one or more chips in a single package
  • G06F15/7825—Globally asynchronous, locally synchronous, e.g. network on chip
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L49/00—Packet switching elements
  • H04L49/10—Packet switching elements characterised by the switching fabric construction
  • H04L49/109—Integrated on microchip, e.g. switch-on-chip
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L49/00—Packet switching elements
  • H04L49/55—Prevention, detection or correction of errors
  • H04L49/552—Prevention, detection or correction of errors by ensuring the integrity of packets received through redundant connections
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F11/00—Error detection; Error correction; Monitoring
  • G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
  • G06F11/16—Error detection or correction of the data by redundancy in hardware
  • G06F11/18—Error detection or correction of the data by redundancy in hardware using passive fault-masking of the redundant circuits
  • G06F11/183—Error detection or correction of the data by redundancy in hardware using passive fault-masking of the redundant circuits by voting, the voting not being performed by the redundant components
  • G06F11/184—Error detection or correction of the data by redundancy in hardware using passive fault-masking of the redundant circuits by voting, the voting not being performed by the redundant components where the redundant components implement processing functionality

Definitions

• This invention relates to a method and apparatus for improving the reliability of a system-on-chip in an embedded computer system.
• the invention relates to a method for error detection in a system-on-chip (SoC) consisting of a number of IP cores, each IP core being a fault-containment unit, and where the IP cores are via a network-on -Chip communicate with each other by means of messages and an excellent IP core, a TRM (Trusted Resource Monitor) realized.
• SoC system-on-chip
• TRM Trusted Resource Monitor
• SoC system-on-chip
• An IP core is a hardware / software component that fulfills a given function.
• the communication of IP cores can be done either through the access of the IP cores to a common memory or via messages.
• PCT / AT 2009/00207 an SoC architecture is presented in which the IP cores communicate exclusively via messages.
• the present invention aims to prevent a faulty IP core of a SoC from failing other IP cores not directly affected by the fault.
• the present invention aims to prevent, in a system-on-chip (SoC) in which a plurality of components (IP cores) communicate exclusively by means of messages, to prevent a fault of one IP core on the others, from Error not directly affected IP cores, propagates.
• SoC system-on-chip
• This goal is achieved by detecting and discarding a faulty control message sent from a nonprivileged IP core to another unprivileged IP core from a (by definition independent) fault containment unit, so that it fails Control message can not cause failure of the message recipient.
• Any message from one IP core that can cause another IP core to fail can be checked by a third IP core and discarded if necessary prevent this erroneous message sent by a failed IP core from causing the failure of another IP core.
• any control message to be sent from a non-privileged IP core to another unprivileged IP core is first sent to a third IP core, this third IP core verifying the message, and where if the message is not faulty, the message is forwarded from this third IP core to the intended final recipient.
• the checking IP core may classify a message as faulty if the evaluation of one of the assurances known to the verifying IP core a priori has the value wrong.
• An advantage is the third IP core of the TRM.
• the TRM only forwards messages from a sender entitled to send a control message to the IP core specified in the message.
• TRM can send a control message to the TII (technology-independent interface) of a non-privileged IP core.
• At least three messages, each from a different IP core, must be sent to the TRM within a predetermined time interval, and where the receiving TRM verifies that at least two of the three messages contain the same instruction before issuing this message the TII interface of the addressed IP core is forwarded.
• At least three messages, each from another SoC, must be sent to the TRM within a predetermined time interval, and where the receiving TRM checks to see if at least two of the three messages contain the same instruction before that message to the TII Interface of the addressed IP core is forwarded. It is expedient if the functions of the privileged subsystem, which consists of the TRM, the Network on Chip and the Network Interfaces, are protected by error-correcting codes.
• the invention relates to an apparatus for performing a method as described above, wherein one or more or all process steps are performed directly in the hardware of the SoCs.
• Fig. 1 shows the structure of a system-on-chip (SoC).
• Fig. 2 shows the structure of an IP core of a SoC.
• Fig. 3 shows the sending of a control message from one IP core to another IP core of a SoC.
• IP 1 shows a SoC 100 with the eight IP cores 111, 112, 113, 114, 115, 116, 117 and 118. These eight IP cores can exchange messages via a network-on-chip 101.
• Each IP core e.g., the IP core 114, is connected to the NoC 101 via a network interface (NI) 102.
• NI network interface
• One of these eight IP cores, e.g. the IP core 111 is a privileged IP core called the Trusted Resource Monitor (TRM), while the remaining seven IP cores 112, 113, 114, 115, 116, 117 and 118 are nonprivileged IP cores.
• TRM Trusted Resource Monitor
• the TRM 111, the Network on Chip 101, and the eight Network Interfaces 102 form the privileged subsystem of the SoC 100.
• an error in this privileged subsystem may result in failure of the entire SoC. Therefore, according to the invention, the functions of the privileged subsystem are to be protected by special error control measures, such as the use of error-correcting codes. Corresponding error-correcting codes can be used to detect and correct transient and permanent hardware errors in the privileged subsystem.
• Each of the seven non-privileged IP cores forms its own Fault-Containment Unit (FCU) (Kopetz, H. (1997) Real-Time Systems, Design Principles for Distributed Embedded Applications; ISBN: 0-7923-9894-7. Boston, Kluwer Academic Publishers.), Ie the consequences of any one Software or hardware failures within an unprivileged IP core can only directly disrupt the functions of the affected IP core, but they can only indirectly affect the functionality of the other IP cores through faulty messages. If bad messages are detected and rejected, the indirect consequences of an IP Core error can not be reproduced. In PCT / AT 2006/00278 an architecture is described in which temporal errors of IP core messages are recognized and discarded by the privileged network interface (NI) 102 of the NoC 101.
• NI privileged network interface
• PCT / AT 2009/00207 (WO 2009/140707), only the TRM 111 is allowed to write temporal parameters to the NI 102 in order to prevent a faulty IP core from independently changing the transmission parameters of a message.
• the method as described in PCT / AT 2006/00278 does not prevent contentually incorrect control messages from being sent from an unprivileged faulty IP core to the other non-privileged IP cores.
• Fig. 2 shows the structure of a nonprivileged IP core, e.g. IP core 114.
• This IP core has four external interfaces: 211, 212, 213 and 122.
• the three message interfaces 211, 212 and 213 are connected to the Network Interface (NI) 102 of FIG.
• the interface 122 is a local interface of the IP core, via which a connection to the outside world of the SoC 100 is realized.
• This interface 122 may be e.g. an input / output network (e.g., a CAN network) or a wireless connection to the SoC 100 environment.
• the message interface 211 is referred to as the Linking Interface (LIF) of the IP core 114. Via the LIF 211, the services of the IP core 114 are offered to the seven other IP cores of the SoC 100.
• LIF Linking Interface
• the message interface 212 will be referred to as a Technology Dependent Interface (TDI) that allows the service technician to communicate with the internal functions of the IP core 114. Since the format and content of these TDI messages depend on the specific implementation technique of the IP core, this interface is implementation-dependent.
• TDI Technology Dependent Interface
• the message interface 213 is called TII (Technology-Independent Interface). Via this TII interface 213, the configuration and the sequence control of the IP core 114 are realized by means of control messages.
• a control message is a message that controls the flow of the calculation in an IP Core. For example, by means of control messages, a hardware reset of the entire IP core 114 is initiated, or the start of a program execution or the termination of a program execution of the IP address. Cores 114 arranged. Furthermore, control messages can be used to configure or reconfigure the SoC.
• a faulty control message sent to the TII interface of the IP core may cause the failure of the IP core 114, eg, if during the correct work of the IP core 114 suddenly a faulty hardware reset message is received at the TII interface 213 becomes.
• the internal structure of the IP core 114 is shown.
• IP core hardware executing the software loaded in the IP core 114.
• IP core internal operating system executing the software loaded in the IP core 114.
• the IP Core internal middleware At the next level 202 is the IP Core internal operating system and at level 203 is the IP Core internal middleware.
• the application software is the application software.
• API application program interface
• the messages received over the TII interface 213 communicate either directly with the IP core hardware 201 (eg a reset message), with the operating system 202 (eg a control message for scheduling a process) or the middleware 203, but not with the application software 204. It is therefore the application software of a non-privileged IP core not possible, faulty control messages, which can be detected via the TII interface 213 to recognize.
• Fig. 3 shows the sending of a control message to the TII interface of a non-privileged IP core. If e.g. If the IP core 115 wants to send a reset message 140 to the IP core 116, it must first send this message 140 to an independent third IP core, the TRM 111, according to the invention. The TRM 111 checks if the message 140 is faulty. This verification is done on the basis of assertions that the TRM needs to know a priori. These representations may relate to the state of the overall system, the identity of the sender, the time of the message, and the content of the message. If all the assertions evaluated by the TRM are correct, then the TRM sends the reset message 141 to the TII interface of the IP core 115.
• the architecture it must be ensured by the architecture that only the (privileged) TRM 111 is able to handle messages to the TII interface of a non-privileged IP core.
• the implementation of a non-privileged IP core must ensure that control messages (such as the reset message) that could cause an IP core failure can only be received via the TII interface. Therefore, according to the invention, it is not possible for a nonprivileged IP core to directly send a control message to another unprivileged IP core.
• the error detection of the control messages via assurances can be regarded as insufficient.
• three parallel-running IP cores need the control commands that are included in the control are embedded, calculate.
• the TRM compares these three control messages and sends a corresponding message to the TII interface of the receiver only if at least two of these messages are identical. This masks any error in one of the three sending IP cores.
• these three parallel control messages must come from three independent SoCs to prevent a common-mode error that can occur within a single SoC.
• This invention substantially improves the reliability of a SoC by preventing a faulty IP core from causing the failure of another IP core.
• the error detection in the received IP core does not make sense, since the receiving IP core can not correctly execute its own error detection in the event of an error.

Landscapes

• Engineering & Computer Science (AREA)
• Theoretical Computer Science (AREA)
• General Engineering & Computer Science (AREA)
• Computer Hardware Design (AREA)
• General Physics & Mathematics (AREA)
• Physics & Mathematics (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Quality & Reliability (AREA)
• Microelectronics & Electronic Packaging (AREA)
• Computing Systems (AREA)
• Computer Security & Cryptography (AREA)
• Data Exchanges In Wide-Area Networks (AREA)
• Hardware Redundancy (AREA)
• Multi Processors (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=43012654

Family Applications (1)

Country Status (5)

Families Citing this family (9)

Family Cites Families (6)

• 2010
  • 2010-07-07 WO PCT/AT2010/000248 patent/WO2011003121A1/de active Application Filing
  • 2010-07-07 JP JP2012518691A patent/JP2012532385A/ja active Pending
  • 2010-07-07 US US13/383,011 patent/US8732522B2/en active Active
  • 2010-07-07 CN CN2010800311123A patent/CN102473121A/zh active Pending
  • 2010-07-07 EP EP10744654A patent/EP2452264A1/de not_active Withdrawn

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events